Cross site scripting

The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page...

CVE-2019-19541

The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page...

CVE-2019-19541

CVE-2019-19541 affects the ListingPro WordPress Directory Theme prior to v2.0.14.2, exposing a persistent XSS vulnerability via the Best Day/Night field on the new listing submit page. Public details in connected records describe the vulnerable input fields and the exploit path, including known P...

CVE-2019-19542

The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page...

CVE-2019-19542

CVE-2019-19542 affects the ListingPro WordPress Directory Theme prior to v2.0.14.2, where a Persistent XSS vulnerability exists via the Good For field on the new listing submit page. Multiple sources (NVD, Red Hat, CNVD/WPVulndb, CVE.org) confirm a stored/reflected cross-site scripting flaw in Li...

PT-2019-15869

Name of the Vulnerable Software and Affected Versions ListingPro theme versions prior to 2.0.14.2 Description The issue concerns a Persistent XSS vulnerability. It can be exploited via the Best Day/Night field on the new listing submit page. Recommendations For versions prior to 2.0.14.2, update ...

PT-2019-15870

Name of the Vulnerable Software and Affected Versions ListingPro theme versions prior to 2.0.14.2 Description The issue is related to a Persistent XSS vulnerability. It occurs via the Good For field on the new listing submit page. Recommendations For versions prior to 2.0.14.2, update to version...

CVE-2019-19541: Improper Neutralization of Input During Web Page Generation

The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page...

CVE-2019-19542: Improper Neutralization of Input During Web Page Generation

The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page...

ListingPro < 2.0.14.5 - Reflected & Persistent Cross-Site Scripting

Reflected & Persistent XSS was discovered in the 'ListingPro - WordPress Directory Theme'. Current version is 2.0.14.2 August 9th 2019. Edit WPScanTeam: November 29th, 2019 - Envato Informed November 29th, 2019 - Envato Investigating December 4th, 2019 - v2.0.14.3 Released, fixing the reflected X...

CVE-2019-13936

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a persistent XSS vulnerability. This issue affects: Siemens AG Polarion All versions 19.2...

CVE-2019-13936: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a persistent XSS vulnerability. This issue affects: Siemens AG Polarion All versions 19.2...

CVE-2019-19085: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML...

CVE-2019-16330

CVE-2019-16330 affects NCH Express Accounts Accounting v7.02, with a persistent XSS in Invoices/Sales Orders/Items/Customers/Quotes input fields. An authenticated unprivileged user can modify these fields to inject arbitrary JavaScript, enabling client-side script execution. Connected documents c...

WordPress Soliloquy Lite 2.5.6 Cross Site Scripting

Exploit Title: Wordpress Soliloquy Lite 2.5.6 - Persistent Cross-Site Scripting Google Dork: inurl:"\wp-content\plugins\soliloquy-lite" Date: 2019-06-13 Exploit Author: Unk9vvN Vendor Homepage: https://soliloquywp.com/ Software Link: https://wordpress.org/plugins/soliloquy-lite/ Version: 2.5.6...

CVE-2019-16330: Improper Neutralization of Input During Web Page Generation

In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...

PT-2019-14630

Name of the Vulnerable Software and Affected Versions NCH Express Accounts Accounting version 7.02 Description The issue concerns a persistent cross-site scripting XSS flaw in the input fields for Invoices, Sales Orders, Items, Customers, and Quotes. An authenticated, unprivileged user can modify...

CVE-2019-16282

In NCH Express Invoice v7.12, persistent cross site scripting XSS exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript...

CVE-2019-16282

CVE-2019-16282 affects NCH Express Invoice v7.12. The vulnerability is a persistent cross-site scripting (XSS) flaw exploitable via the Invoices/Items/Customers/Quotes input fields. An authenticated unprivileged user can modify parameters in these fields to inject arbitrary JavaScript. The issue ...

PT-2019-14611

Name of the Vulnerable Software and Affected Versions NCH Express Invoice version 7.12 Description The issue concerns a persistent cross-site scripting XSS flaw. This flaw can be exploited via the input fields for Invoices, Items, Customers, and Quotes. An authenticated, unprivileged user can...